Mental Models and Folk Models of Home Computer Security

These flashcards cover the key concepts from Rick Wash's research on folk models of computer security and the general theory of mental models as discussed in the lecture.

Mental Model

A concept from psychology, brought to HCI by Don Norman, describing the personal understandings people use to make decisions and simulate how things work internally.

Folk Model

An informal, potentially scientifically incorrect explanation of how something works that helps individuals make everyday decisions.

Rick Wash (2010)

The author of the paper "Folk Models of Home Computer Security" who researched why ordinary people make security decisions that seem irrational to experts.

HCI

Human-Computer Interaction, a field where the theory of mental models is used to understand how users interact with technology.

Kempton's Thermostat Study

An illustration used to show how homeowners guide their behavior using technically incorrect mental models of how engineering works.

Bad Bugs

A folk model for viruses where the user believes they are simply "bad" without understanding how they work or their specific intensity.

Buggy Software

A folk model for viruses where the user believes malware infects a computer specifically when clicking on or downloading suspicious files.

Mischief

A folk model for viruses where users expect a visible sign of infection, such as pop-up windows or a crashing computer.

Crime (Virus Model)

A folk model for viruses characterized by the belief that their main purpose is to steal personal information to facilitate financial crimes.

Digital Graffiti Artists

A hacker folk model describing individuals who break into systems for fun, reputation, or excitement rather than money.

Burglars

A hacker folk model describing individuals who target bank accounts and credit cards because there is a clear financial reward.

Big Fish Hunters

A hacker folk model where attackers only target wealthy, powerful, or important people, leading ordinary users to feel they are at low risk.

Contractors

A hacker folk model describing skilled individuals who work for organized criminal organizations and target large institutions.

Botnets

A category of malware that fails to fit most user folk models because it stays hidden, does not damage files, and turns the computer into an attack resource without user action.

Secondary Task

The idea that security is not a user's main goal, meaning they have limited "attentional currency" and time to learn complex security concepts.

Wash's Study Methodology

A qualitative research study consisting of interviews with $33$ non-expert home computer users conducted between $2007$ and $2008$ in three Midwestern US cities.

Invisible Consequences

A major difference between computer security and physical security (like door locks), where the underlying world of digital threats is totally hidden from the average person.